e3f036ecd6f6b22ed68fdfa2c6e211a3ad0b2efd4b202c51e1a94dcc343e6bab

Analysis

max time kernel
857s
max time network
1588s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04-05-2024 15:17

Target

Bitcoin+Fake+Transac...rar
Size

304.8MB
MD5

276e47ce2deff90b6e7c0ea9496b91bf
SHA1

a139f00c2224303a5966a4e640ba62e0b5093bba
SHA256

e3f036ecd6f6b22ed68fdfa2c6e211a3ad0b2efd4b202c51e1a94dcc343e6bab
SHA512

90af10dd5d1f1916492518cbacd162bfabceae26d6f8681e5dde517c3e24cb8d04280bae41dd947e5462ab00d22ec9113f19bc323c15ce40bfdaa3861e3d3e9f
SSDEEP

6291456:2PE5JH1U8fbAZiTS7a5Wq0haXAeldkl9uivCVaVfR/JSiYI8z8MZhekn+mq/HWlg:qUpLS3LoXAEdCjVfR/JWI8z8MZheU+mO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Bitcoin+Fake+Transac...rar
1⤵
- Modifies registry class
PID:4920

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact